Return to Answer

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Hi Robert, both applications are in the same network and wouldn't need to make calls across the firewall. Does that make easier to call SP webservices from that html/jquery page?

It's all about the same origin policy, not about networking. Since SharePoint does not support JSONP/CORS, you have to respect the same origin policy. If the systems are not in the same DNS domain (i.e. portal.company.com), then by doing an AJAX call to the SharePoint server would be enabling an XSS attack. The only way to accomplish this scenario without a proxy, would be to introduce serious security vulnerability into the your users' browsers.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Hi Robert, both applications are in the same network and wouldn't need to make calls across the firewall. Does that make easier to call SP webservices from that html/jquery page?

It's all about the same origin policy, not about networking. Since SharePoint does not support JSONP/CORS, you have to respect the same origin policy. If the systems are not in the same DNS domain (i.e. portal.company.com), then by doing an AJAX call to the SharePoint server would be enabling an XSS attack. The only way to accomplish this scenario without a proxy, would be to introduce serious security vulnerability into the your users' browsers.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Hi Robert, both applications are in the same network and wouldn't need to make calls across the firewall. Does that make easier to call SP webservices from that html/jquery page?

It's all about the same origin policy, not about networking. Since SharePoint does not support JSONP/CORS, you have to respect the same origin policy. If the systems are not in the same DNS domain (i.e. portal.company.com), then by doing an AJAX call to the SharePoint server would be enabling an XSS attack. The only way to accomplish this scenario without a proxy, would be to introduce serious security vulnerability into the your users' browsers.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

If the stand alone web application and SharePoint are not in the same domain, the simple answer is that you cannot unless you are using Apps.

The more complex answer is that you would need to have a proxy of some sort to do this. You could write a simple layer 7 proxy inside the non-SharePoint web app that forwards the requests and the authentication or use something like Squid or even IIS itself to do this.

Another consideration might be hosting the non-SharePoint site in the same domain as SharePoint.

In order to pass the original user's credentials you'll need to configure the WCF to use Kerberos Constrained Deligation.